wiz
40ac848024
Fix various misspellings of compatible/compatibility.
2001-06-11 01:50:48 +00:00
mrg
6a536c0364
fix a IPNOPRIVPORTS unused variable botch. noted by proff.
2001-06-06 06:07:06 +00:00
thorpej
ad9d3794b0
Implement support for IP/TCP/UDP checksum offloading provided by
...
network interfaces. This works by pre-computing the pseudo-header
checksum and caching it, delaying the actual checksum to ip_output()
if the hardware cannot perform the sum for us. In-bound checksums
can either be fully-checked by hardware, or summed up for final
verification by software. This method was modeled after how this
is done in FreeBSD, although the code is significantly different in
most places.
We don't delay checksums for IPv6/TCP, but we do take advantage of the
cached pseudo-header checksum.
Note: hardware-assisted checksumming defaults to "off". It is
enabled with ifconfig(8). See the manual page for details.
Implement hardware-assisted checksumming on the DP83820 Gigabit Ethernet,
3c90xB/3c90xC 10/100 Ethernet, and Alteon Tigon/Tigon2 Gigabit Ethernet.
2001-06-02 16:17:09 +00:00
itojun
781f6920ab
use default hoplimit when incoming interface is not given to icmp6_reflect.
...
sync with kame
2001-06-01 05:54:19 +00:00
mrg
67afbd6270
use _KERNEL_OPT
2001-05-30 11:57:16 +00:00
thorpej
c973d6a0eb
Skip the pseudo-header if nxt == 0. This is already documented
...
in in6_cksum(9) and is also the behavior of the i386 optimized
version.
2001-05-30 03:06:56 +00:00
itojun
e91c2ce847
remove debug printfs, which can be too noisy. sync with kame.
2001-05-27 17:36:07 +00:00
itojun
fc644273cd
print more diag message on in6_addmulti() failures.
2001-05-24 08:17:22 +00:00
itojun
a7596d1912
call icmp6_mtudisc_update(foo, 0) even if ICMPv6 messages are very short.
...
let icmp6 layer decide whether we take PMTUD routes or not.
2001-05-24 07:22:27 +00:00
itojun
fc66251bda
plug memory leak on invalid fragment packet. supress noisy log. from kame
2001-05-17 14:01:37 +00:00
itojun
498fdebcd7
drop multi destination mode (IFF_LINK0).
2001-05-14 13:35:20 +00:00
itojun
f4d5905544
there's no need to #if NFAITH here. IN6P_FAITH can be set even on
...
NFAITH == 0 kernel, it is safer to always check the condition.
sync with kame.
2001-05-11 18:38:03 +00:00
itojun
63181d71c1
correct ecn consideration on tunnel encap/decap. sync with kame.
2001-05-10 01:37:42 +00:00
itojun
1bec764d78
correct faith prefix determination. use sys/netinet/if_faith.c:faithprefix()
...
to determine. sync with kame.
(without this change, non-faith socket may mistakenly accept for-faith traffic)
2001-05-08 10:15:13 +00:00
itojun
d1b6307b88
do not copy TTL field on ipsec tunnel mode encapsulation. sync with kame
2001-04-15 01:55:49 +00:00
thorpej
bf2dcec4f5
Remove the use of splimp() from the NetBSD kernel. splnet()
...
and only splnet() is allowed for the protection of data structures
used by network devices.
2001-04-13 23:29:55 +00:00
itojun
f4e4c674a7
disallow userland programs from specifying addresses with IPV6_PKTINFO
...
setsockopt, if:
- the address is not verified by DAD (= not ready)
- the address is an anycast address (= not permitted as source)
sync with kame
2001-04-11 04:57:53 +00:00
itojun
5ed8fd262b
suppress RS/RA log messages (can be re-enabled by net.inet6.icmp6.nd6_debug),
...
as they may fill up /var. sync with kame.
2001-04-04 06:28:41 +00:00
itojun
2abaa8eae5
make sure rcvif is sane on call to icmp6_reflect
2001-04-04 06:28:40 +00:00
itojun
92969654c0
enable FAKE_LOOPBACK_IF case by default.
...
now traffic on loopback interface will be presented to bpf as normal wire
format packet (without KAME scopeid in s6_addr16[1]).
fix KAME PR 250 (host mistakenly accepts packets to fe80::x%lo0).
sync with kame.
2001-03-30 11:08:56 +00:00
itojun
dbcd4b8d03
fix constness of IN6_{IS,ARE}_xx with RFC2553. sync with kame.
2001-03-30 05:53:52 +00:00
itojun
2fb1887b31
re-initialize mopt in ip6_insert_jumboopt(). sync with kame
...
From: csapuntz@stanford.edu
2001-03-25 09:58:43 +00:00
itojun
0c8d8ae7a0
couple of missing splx. sync with kame.
...
From: csapuntz@play-doh.stanford.edu (Constantine Sapuntzakis)
2001-03-25 09:06:03 +00:00
itojun
3e898c9239
in nd6_cache_lladdr(), set nd6_gctimer to ln_expire just after the state
...
transition to STALE. fixes tahi test breakage. sync with kame.
2001-03-21 21:56:29 +00:00
thorpej
20fe4e2d96
Add a protosw flag, PR_ABRTACPTDIS (Abort on Accept of Disconnected
...
Socket), and add it to the protocols that use that behavior (all
PR_LISTEN protocols except for PF_LOCAL stream sockets).
2001-03-21 19:22:27 +00:00
itojun
4ce63adb1e
do not inject packets to ipfilter, if the packet went through IPsec tunnel.
...
http://www.netbsd.org/Documentation/network/ipsec/#ipf-interaction
2001-03-21 19:12:56 +00:00
itojun
93b8b31feb
set rmx_mtu to L2 interface mtu, instead of 0, on mtudisc timeout.
...
ip6_output() change is for safety. sync with kame
2001-03-21 07:52:13 +00:00
itojun
e4ecd03f2a
drop packets with link-local addresses,
...
if (internally-used) interface ID portion is already filled. sync with kame
2001-03-16 12:22:34 +00:00
itojun
27a0af5865
nd6_storelladdr() was not consistent about m_freem() policy.
...
do not touch RTF_STATIC entries (static ND entries) on ND cache update.
couple of costmetic sync. sync with kame
2001-03-08 10:49:32 +00:00
itojun
7695280d34
more missing splx. from kame
2001-03-08 10:48:40 +00:00
itojun
912f42ecda
remove bogus rtfree. sync with kame. inspired by openbsd PR 1706.
2001-03-08 00:19:03 +00:00
itojun
4e45315377
missing splx. from aaron@openbsd. sync with kame
2001-03-07 22:50:14 +00:00
itojun
c9e08725bc
avoid possible alignment issue. sync with kame
2001-03-04 16:49:17 +00:00
itojun
dc3424f555
pass key to rijndael logic as binary, not hexadecimal string.
...
sync with kame
2001-03-02 15:42:39 +00:00
itojun
f03176a0a8
have comment that refers to kame COVERAGE document. sync with kame
2001-03-02 04:55:40 +00:00
itojun
8c8c2f71a4
the date string in KAME version is getting very meaningless, remove.
2001-03-02 04:52:54 +00:00
itojun
2d6047cff9
make sure to enforce inbound ipsec policy checking, for any protocols on top
...
of ip (check it when final header is visited). sync with kame.
XXX kame team will need to re-check policy engine code
2001-03-01 16:31:37 +00:00
itojun
233e3963ed
make sure to validate packet against ipsec policy.
2001-02-26 07:20:44 +00:00
cgd
023e9f0649
C requires that labels be followed by statements.
2001-02-24 00:01:22 +00:00
itojun
f2a66201fc
garbage-collect stale ND entries (default: 1 day).
...
RFC 2461 5.3. sync with kame.
2001-02-23 08:02:41 +00:00
itojun
e1196a8f6e
remove unnecessary state, ND6_LLINFO_WAITDELETE, from neighbor cache
...
state machine.
no need for RTF_REJECT on neighbor cache entires, they are leftover from
ARP code.
sync with kame.
2001-02-23 06:41:50 +00:00
itojun
2df943e652
correct handling of upper limitation to # of reass queue.
2001-02-22 05:04:42 +00:00
itojun
49889b3afd
be more more picky about option length parsing. sync with kame
2001-02-22 01:40:25 +00:00
itojun
e1e316562b
make validation code more strict for ND6/dest6 variable length headers.
...
check duplicated nd6_ifinfo table initialization in a better way.
sync with kame
2001-02-21 17:23:09 +00:00
itojun
96413230d1
style, to make kame sync easier
2001-02-21 16:28:43 +00:00
itojun
52f2cece9f
tighten AH IPv4 option chasing more. drop too short (< 2) option.
...
sync with kame.
2001-02-21 01:27:58 +00:00
itojun
c9928e0ab1
need PR_ADDR|PR_ATOMIC for IPPROTO_EON. fix typo. from chopps, sync with kame
2001-02-21 00:11:53 +00:00
itojun
da8a3f0179
add AF_ISO case to output. from chopps.
2001-02-20 10:41:47 +00:00
itojun
176db3e930
ISO over IPv4/v6 by EON encapsulation. from chopps, sync with kame.
2001-02-20 08:49:15 +00:00
itojun
5bc3f3ff96
correct IPv4 option handling.
2001-02-19 04:24:27 +00:00
itojun
26a76076be
correct IPv4 option header chasing. the old code may overrun the buffer
...
if the option header is truncated. sync with kame
2001-02-19 03:47:01 +00:00
itojun
e6dbed9659
wording in comment.
...
is contradict -> "is contradictory", or "contradicts".
2001-02-16 15:13:40 +00:00
itojun
f99a50f858
protect router list management by splsoftnet properly. sync with kame
2001-02-11 07:12:01 +00:00
itojun
1bc6ca28a1
make sure to clean ln_byhint on reachability confirmation.
2001-02-11 07:00:03 +00:00
itojun
1442c06fae
wrap kernel-only #define (kame cross-bsd portability) into _KERNEL.
2001-02-11 06:50:59 +00:00
itojun
bc5a6e2482
pull latest kame pcbnotify code. synchronizes ICMPv6 path mtu discovery
...
behavior with other protocols (i.e. validation, use of hiwat/lowat).
2001-02-11 06:49:49 +00:00
itojun
2390806e17
whitespace sync with kame
2001-02-11 05:25:04 +00:00
itojun
5318e0ee0f
remove #ifdef __FreeBSD__.
2001-02-11 05:24:21 +00:00
itojun
37bb4bf58b
set frag6_doing_reass properly (for frag6_drain). sync with kame.
2001-02-11 05:05:27 +00:00
itojun
7781d63a92
recover $NetBSD$ (removed by mistake)
2001-02-11 04:53:49 +00:00
itojun
9a9c998cc7
add missing IFAFREE() in error recovery case.
2001-02-11 04:29:30 +00:00
itojun
e1f4f77960
to sync with kame better, (1) remove register declaration for variables,
...
(2) sync whitespaces, (3) update comments. (4) bring in some of portability
and logging enhancements. no functional changes here.
2001-02-10 04:14:26 +00:00
itojun
4cd9449e34
initialize "mbz" member. kame 1.35 -> 1.36
2001-02-10 03:06:39 +00:00
itojun
7f548573d5
cosmetic changes to sync with kame. tabify and minor local variable renames
2001-02-10 02:19:57 +00:00
itojun
20e2452579
fix if_set for architectures with sizeof(long) != 4. IF_xxx behaved badly.
...
(no fear of overrun, since index was mistakenly computed to too small value)
2001-02-10 02:10:14 +00:00
itojun
6b9104e0f7
sync with kame better. cosmetic/stat changes only.
2001-02-08 18:43:17 +00:00
itojun
ae819d9324
move udp6_output() to separate file. (sync better with kame)
2001-02-08 16:48:01 +00:00
itojun
109fcc5522
implement upper limit to icmp6 redirects (experimental, turned off)
...
negative value to {mtudisc,redirect}_{hi,lo}wat will turn off the limitation.
sync with kame.
2001-02-08 16:07:39 +00:00
itojun
179a7e0d7b
send up dst_unreach_admin error to local node, if transport-mode
...
ipsec key is not found. rather experimental. kame 1.83 -> 1.84
nuke IPSEC_SRCSEL which does not do the right thing.
adjust state->ro if the tunnel endpoint is offlink. KAME PR 233.
kame 1.84 -> 1.85
2001-02-08 15:04:26 +00:00
itojun
574214f10a
amove in6_{embed,recover}scope prototypes to in6_var.h (kernel only).
...
add in6_clearscope. sync with kame
2001-02-08 14:56:15 +00:00
itojun
a1d89972c7
when chasing nd6_llinfo chain, make sure we do not touch dangling
...
pointer (due to RTM_DELETE during default router list management).
from kame
2001-02-08 12:57:54 +00:00
itojun
c8e86cc06a
remove bogus DIAGNOSTIC. sync with kame
2001-02-07 10:56:38 +00:00
itojun
22b473e0f6
during ip6/icmp6 inbound packet processing, do not call log() nor printf() in
...
normal operation (/var can get filled up by flodding bogus packets).
sysctl net.inet6.icmp6.nd6_debug will turn on diagnostic messages.
(#define ND6_DEBUG will turn it on by default)
improve stats in ND6 code.
lots of synchronziation with kame (including comments and cometic ones).
2001-02-07 08:59:47 +00:00
itojun
172e802b90
bad semicolon after "if" conditional. sync with kame
2001-02-06 01:27:29 +00:00
chs
09cb38f22b
expose the definitions of MIN() and MAX() in sys/param.h to the kernel
...
and use those in favor of a dozen copies scattered around the source tree.
2001-02-05 10:42:40 +00:00
itojun
d17dfd2fc0
avoid panic when a packet with nonexistent link-local address is issued.
...
kame 1.151 -> 1.152.
2001-02-02 15:54:56 +00:00
itojun
617b3fab7e
- record IPsec packet history into m_aux structure.
...
- let ipfilter look at wire-format packet only (not the decapsulated ones),
so that VPN setting can work with NAT/ipfilter settings.
sync with kame.
TODO: use header history for stricter inbound validation
2001-01-24 09:04:15 +00:00
itojun
8b3234d2f2
minimize diff with the latest kame tree.
2001-01-23 05:21:23 +00:00
itojun
a836499e32
make it possible to turn off ingress filter on gif/stf tunnel egress,
...
by using IFF_LINK2. (part of) PR 11163 from Ken Raeburn.
2001-01-22 07:51:01 +00:00
itojun
60240f3ab9
workaround to avoid EMSGSIZE when ND6 table for the outgoing interface
...
is not initialized (should result in "interface down").
2001-01-18 06:50:12 +00:00
itojun
43950f6d05
on interface removal (ifconfig destroy) do not remove default route by mistake
2001-01-18 06:49:11 +00:00
itojun
4dbe2a5a97
wrap noisy ND6 debugging messages with ND6_DEBUG. sync with kame
2001-01-17 11:26:52 +00:00
itojun
df9784d749
pull post-4.4BSD change to sys/net/route.c from BSD/OS 4.2 (UCB copyrighted).
...
have sys/net/route.c:rtrequest1(), which takes rt_addrinfo * as the argument.
pass rt_addrinfo all the way down to rtrequest, and ifa->ifa_rtrequest.
3rd arg of ifa->ifa_rtrequest is now rt_addrinfo * instead of sockaddr *
(almost noone is using it anyways).
benefit: the follwoing command now works. previously we need two route(8)
invocations, "add" then "change".
# route add -inet6 default ::1 -ifp gif0
remove unsafe typecast in rtrequest(), from rtentry * to sockaddr *. it was
introduced by 4.3BSD-reno and never corrected.
XXX is eon_rtrequest() change correct regarding to 3rd arg?
eon_rtrequest() and rtrequest() were incorrect since 4.3BSD-reno,
so i do not have correct answer in the source code.
someone with more clue about netiso-over-ip, please help.
2001-01-17 04:05:41 +00:00
itojun
039777e3c8
s/ND6DEBUG/ND6_DEBUG/ to meet other places
2001-01-16 06:16:37 +00:00
itojun
9f119cbf91
wrap icmp6 checksum error printf() into #ifdef ND6DEBUG.
...
sync with kame, NetBSD PR 11911.
2001-01-08 06:12:46 +00:00
itojun
6562709f3a
typo fix. PR 11889
2001-01-04 11:48:44 +00:00
thorpej
ad5b855ef0
Back out the sledgehammer damage applied by wiz while I was out for
...
the holiday.
2000-12-28 21:40:59 +00:00
itojun
8b9fb822b0
do not touch ra_addr if it is NULL. from IIJ SEIL team
2000-12-28 21:23:00 +00:00
wiz
32e20d8993
Back out previous change. It causes NAT to fail, and was CLEARLY
...
NOT TESTED before it was committed.
2000-12-25 02:00:46 +00:00
thorpej
d0357bdb4f
Slight adjustment to how pfil_head's are registered. Instead of a
...
"key" and a "dlt", use a "type" (PFIL_TYPE_{AF,IFNET} for now) and
a val/ptr appropriate for that type. This allows for more future
flexibility with the pfil_hook mechanism.
2000-12-22 20:01:17 +00:00
itojun
b05acc70f8
make sure we notify of routing changes, even if we have net route pointed
...
to by inpcb.
2000-12-21 00:46:20 +00:00
thorpej
d9a9544a2f
Add ALTQ glue. XXX Temporary until ALTQ is changed to use a pfil hook.
2000-12-14 17:36:44 +00:00
itojun
1101f217b5
no need to rtalloc1() twice in pmtud. from kame
2000-12-11 19:28:47 +00:00
itojun
5eae50d991
update icmp6 too big validation. the change is necessary since pmtud is
...
mandatory for IPv6 (so we can't just validate by using connected pcb - we need
to allow traffic from unconnected pcb to do pmtud).
- if the traffic is validated by xx_ctlinput, allow up to "hiwat" pmtud
route entries.
- if the traffic was not validated by xx_ctlinput, allow up to "lowat" pmtud
route entries (there's upper limit, so bad guys cannot blow up our routing
table).
sync with kame
XXX need to think again about default hiwat/lowat value.
XXX victim selection to help starvation case
2000-12-09 01:29:45 +00:00
itojun
fe5bd7125e
make sure we don't touch uninitialized pointer. from: fvdl
2000-12-04 12:11:49 +00:00
thorpej
65fd25ea82
Restructure the PFIL_HOOKS mechanism a bit:
...
- All packets are passed to PFIL_HOOKS as they come off the wire, i.e.
fields in protocol headers in network order, etc.
- Allow for multiple hooks to be registered, using a "key" and a "dlt".
The "dlt" is a BPF data link type, indicating what type of header is
present.
- INET and INET6 register with key == AF_INET or AF_INET6, and
dlt == DLT_RAW.
- PFIL_HOOKS now take an argument for the filter hook, and mbuf **,
an ifnet *, and a direction (PFIL_IN or PFIL_OUT), thus making them
less IP (really, IP Filter) centric.
Maintain compatibility with IP Filter by adding wrapper functions for
IP Filter.
2000-11-11 00:52:36 +00:00
itojun
a21e536042
improve spec conformance of node information query (07).
...
sync with kame.
2000-11-11 00:46:36 +00:00
itojun
970a75f808
fix KAME PR 296 again, for transport-mode SA only
...
(shortterm workaround - need revisit for ANY SA)
2000-11-10 01:10:36 +00:00
itojun
8c411160ec
backout KAME PR 296. "any" mode SA should be able to be used for tunnel mode.
2000-11-09 17:36:11 +00:00
itojun
e452bf6c6b
save a little bit of CPU time (avoid computing CBC IV we do not use).
...
sync with kame.
2000-11-08 04:57:57 +00:00